Privacy Policy

1. Definitions

The following capitalised terms are used throughout this Privacy Policy and the related Terms of Use and Parental Consent Form:

• "Portal" means the Signal Tennis Coaching Analytics Portal: the authenticated, client-facing application that delivers reports, charts, video analysis, and performance statistics to enrolled players, parents, and coaches.
• "Public Tennis Data" means player information, match history, club and regional affiliations, ratings and rankings, and any related competitive data made available by tournament-software platforms, the UTR platform, the World Tennis Number (WTN) platform, Tennis Ireland, the ITF, Tennis Europe, and any other comparable governing body, ratings system, or tournament-management site, including any derivative works, exports, scrapes, or aggregations thereof.
• "Anonymised data" means data from which all direct and indirect identifiers have been removed in such a way that the subject can no longer be identified, re-identified, or singled out by any reasonably available means. Under GDPR Recital 26, anonymised data is not personal data and falls outside the scope of GDPR.
• "Group-level data" or "aggregates" means statistics calculated across a group of players (e.g. squad averages, age-group benchmarks) where no individual can be identified from the output.

2. What Data We Collect

2.1 Website visitors

When you visit our public website, we collect only:

• Contact form submissions: your name, email address, service interest, and message (stored as a ContactEnquiry record)
• Newsletter signups: your email address only
• Session cookies: see Section 8 (Cookies) below

2.2 Portal users (clients)

When you or your child are enrolled in the coaching programme and use the Signal Tennis Portal, we collect and process:

Identity and profile data

• Name, age group, playing hand, backhand type
• Tennis Ireland profile link and UTR profile link (if applicable)
• World Tennis Number (WTN) and national ranking
• Club affiliation

Performance and coaching data

• Match statistics (serve %, return %, rally data, win/loss records)
• Coaching session records (dates, focus areas, coach notes)
• Scouting reports and performance benchmarks
• Statistical snapshots compared against squad and tour-level averages

Video and image data

• Video recordings of matches and practice sessions
• Technique analysis videos (slow-motion, match footage, practice footage)
• Frame-by-frame technique images (serve motion, stroke mechanics)
• Match highlight clips

Analytical outputs

• Performance reports (PDF documents)
• Statistical charts and visualisations
• Interactive match analysis charts
• Squad-level aggregate analytics (individual data may be included in anonymised group averages)

User-submitted content

• Questions submitted to the coach via the Portal
• Match reports or match reflections written by the player
• Diary entries, goals, or self-reflection notes
• Any other free-text content the player or parent enters into the Portal

2.3 Public Tennis Data

We also collect and process Public Tennis Data (as defined in Section 1) about enrolled players from publicly available sources: tournament-software platforms, the UTR platform, the WTN platform, Tennis Ireland, the ITF, Tennis Europe, and comparable governing bodies. We may combine Public Tennis Data with data held in the Portal to produce a complete coaching picture. Because Public Tennis Data is already in the public domain, we process it on a legitimate-interest basis (see Section 4).

3. Why We Process Your Data

We process personal data for the following purposes:

• Coaching delivery: to provide personalised tennis coaching, track progress, and plan future sessions
• Performance analysis: to identify strengths, areas for improvement, and development trends over time
• Benchmarking: to compare performance against squad averages and professional tour-level statistics
• Reporting: to generate performance reports, charts, and visual summaries shared with authorised users
• Video review: to enable coach and player review of match and technique footage for improvement purposes
• Cross-portal video display: where video footage shows more than one player (e.g. match opponents, squad training partners), it may be displayed in the Portal accounts of every consented player who appears in the footage. Video is only shown when every identifiable player in frame has active consent; if any player in frame has no consent on file, the footage is not displayed in any portal.
• Anonymised peer comparisons: to show clients their own rank within their squad or age group against anonymised peers (rank positions only, no other players' names displayed), and to show clients' anonymised ranks to other consented players in the same group. This is delivered back to the client as a service benefit.
• Algorithm and model training (separate consent required): to train algorithms, statistical models, and analytics tools used by Signal Tennis. Only data from subjects who have given this specific consent is used for this purpose, and the data is anonymised for training use.
• Commercial use of anonymised aggregates (separate consent required): to produce group-level aggregates and anonymised datasets that may be published, shared, or sold to third parties for commercial purposes. See Section 5.
• Communication: to respond to contact form enquiries and send newsletter updates (if subscribed)

4. Legal Basis for Processing

We process personal data under the following legal bases:

• Consent (Article 6(1)(a) GDPR): for coaching programme data, video and image processing, algorithm training, commercial use of anonymised aggregates, peer comparisons, contact form submissions, and newsletter subscriptions. You may withdraw consent at any time.
• Legitimate interests (Article 6(1)(f) GDPR): for (a) processing of Public Tennis Data (already publicly available); (b) anonymised squad-level aggregate statistics where individual data cannot be identified; and (c) the anonymisation pipeline itself, which exists to reduce the risk of personal-data exposure.

For children under 16, the legal basis for consent-based processing is parental or guardian consent under GDPR Article 8 and Section 31 of the Data Protection Act 2018.

5. Anonymised and Group-Level Data

Where you or a parent/guardian has given separate consent on the Parental Consent Form or its adult equivalent, Signal Tennis may process personal data into anonymised and group-level forms and use the resulting outputs for commercial purposes.

5.1 How we anonymise data

Before anonymised outputs are used for commercial purposes, we:

• Remove all direct identifiers (name, contact details, date of birth, profile URLs, club)
• Remove indirect identifiers that could support re-identification in combination (e.g. coarsen dates, drop opponent names, drop session-note free text)
• Aggregate shot-level data where fine granularity is not required for the downstream use
• Apply irreversibility checks so the output cannot be re-linked to the subject by any reasonably available means

5.2 What we use anonymised data for

Anonymised and group-level data may be:

• Published in blog posts, research notes, and educational content
• Shared with coaching partners, clubs, and national federations
• Sold or licensed to third parties for commercial analytics products or research
• Used to train algorithms, models, and analytics tools

Once data has been irreversibly anonymised under GDPR Recital 26 it is no longer personal data and falls outside the scope of GDPR. Our commitment is that the anonymisation is genuine and not a relabelling exercise. If data can be re-linked to a subject by any reasonably available means, we do not treat it as anonymised.

6. Children's Data

Many of our coaching clients are under 16 years of age. Under Irish law (Data Protection Act 2018, Section 31) and Article 8 of the GDPR, where a child is under 16 years of age, consent for the processing of their personal data must be given or authorised by the holder of parental responsibility.

Before processing a child's data through the Portal, we require written consent from a parent or guardian via our Parental Consent Form. A child aged 16 or over may provide their own consent.

What the Parental Consent Form covers (and does not cover). The Parental Consent Form authorises Signal Tennis to process your child's data for the coaching service described in this policy: session capture, performance analysis, Portal delivery, and the optional secondary uses listed in Sections 9.1 to 9.5 of that form. It does not authorise any public marketing use of your child's name, image, video, or results. Public-channel use (for example the Signal Tennis website, social media, printed brochures, or testimonials) requires a separate Media Release which is issued only when specifically needed and is independent of the Parental Consent Form.

Declining an optional consent will not affect your child's place. Section 9.0 of the Parental Consent Form covers the core coaching service. Sections 9.1 to 9.5 cover optional secondary uses (within-Portal video visibility, algorithm training, commercial sharing of anonymised aggregates, anonymised peer comparisons, and marketing communications). Declining any of Sections 9.1 to 9.5 will not affect your child's place in the coaching programme or the quality of coaching they receive.

7. Who Has Access to Your Data

Role	What they can see
Head Coach (Kieran Lardner)	All data for all players in the programme
Player (if given a login)	Their own profile, sessions, videos, reports, and charts only
Parent/Guardian (if given a login)	Their child's profile, sessions, videos, reports, and charts only
Club coaches (if granted access)	Only players they are authorised to view

Access is controlled by a role-based permission system. Users can only see players they have been explicitly granted access to. No data is publicly accessible: the Portal requires authentication for all player data.

We do not sell, share, or provide personal (identifiable) data to any third party for marketing or commercial purposes. Anonymised and group-level data may be shared or sold commercially where separate consent has been given. See Section 5.

8. Where Data Is Stored

Data type	Service provider	Location
Portal application and database	Heroku (Salesforce)	EU region
Reports, charts, and images	Cloudflare R2	EU region
Video footage	Bunny.net	EU CDN nodes
Source coaching data	Local encrypted storage	Ireland
Error monitoring (IP addresses, user agents, request metadata, stack traces)	Sentry	EU region
Transactional email (email addresses, names in email content)	Postmark	US (DPA signed)
Web analytics (page URLs, referrers only -- no personal data, no cookies)	Plausible	EU region

All service providers are bound by data processing agreements. Data is transmitted over encrypted connections (HTTPS/TLS). Files stored in cloud storage are accessed only via time-limited signed URLs that expire after a short period.

8.1 Data Processors

The following third-party services process data on our behalf:

• Cloudflare R2 -- file storage for reports, charts, and images. DPA in place.
• Bunny.net -- video hosting and delivery via CDN. DPA in place.
• Heroku (Salesforce) -- application hosting and database. DPA in place.
• Sentry -- error monitoring service. Processes IP addresses, user agents, request metadata, and stack traces for error detection and debugging. DPA accepted via Sentry Terms of Service. EU region.
• Postmark -- transactional email service. Processes email addresses and names for sending password resets, consent verification emails, and notifications. DPA in place.
• Plausible -- privacy-focused web analytics. Processes page URLs and referrers only. Plausible is cookie-free and does not process personal data. DPA in place.

9. Parental Consent

For players under 16, we require parental consent before processing their data. We offer two levels of consent:

• Portal Standard: access to public tournament data, basic player profile, and text-based coaching session records. Does not include video processing, technique images, or custom statistical reports.
• Enhanced Services: the full coaching pipeline including video processing, custom statistics, personalised reports and charts, technique images, and squad-level comparisons.

Declining Enhanced Services does not affect a child's place in the coaching programme. For full details, see our Parental Consent Information page.

10. Cookies

Signal Tennis uses only essential cookies required for the website to function. We do not use any third-party tracking, advertising, or analytics cookies.

Cookie	Purpose	Duration
sessionid	Django session cookie: maintains your login state	Browser session (expires on close) or 2 weeks if "remember me" is used
csrftoken	Cross-site request forgery protection: security token for form submissions	1 year

These cookies are strictly necessary for the operation of the website and do not require consent under GDPR cookie regulations.

11. Data Retention

• Active player data is retained for as long as the player is enrolled in the coaching programme.
• Video footage is retained for the duration of the coaching relationship.
• Performance reports and charts are retained to allow longitudinal tracking of development.
• User-submitted content (questions to the coach, match reports, diary entries) is retained for the duration of the coaching relationship unless you request earlier deletion.
• Contact form enquiries are retained for up to 12 months, then deleted.
• Newsletter subscriptions are retained until you unsubscribe.
• Upon withdrawal of consent or leaving the programme, personal (identifiable) data will be deleted within 30 days of a written request, except where retention is required by law or where you have separately consented to anonymised retention (see 11.1).

For full retention periods by data category, see our Data Retention Policy.

11.1 Retention after erasure (anonymisation carve-out)

Where you or a parent/guardian has given separate consent on the Parental Consent Form, we may retain the underlying data in irreversibly anonymised form after an erasure request. In practice this means that, on erasure:

• Name, contact details, date of birth, profile URLs, and any other identifiers are deleted
• Any video frame showing the subject's face is deleted or processed so the subject cannot be re-identified
• Underlying shot-level data (stroke, outcome, rally length, etc.) may be retained with all identifiers stripped and may continue to contribute to squad averages, national benchmarks, algorithm training, and commercial aggregates

Public Tennis Data is out of scope for erasure. Public Tennis Data remains publicly available from its original source (tournament software, UTR, WTN, ITF, Tennis Europe, etc.) regardless of any action we take. If you request erasure we will delete our stored copy; however, we are entitled to re-source it from its public origin at any time.

11.2 User-submitted content

Questions submitted to the coach via the Portal, match reports, diary entries, and similar user-generated content can be deleted on request. Where you have given separate consent, the content itself may be retained in fully anonymised form (with all identifying information removed) for algorithm training and service improvement.

12. Your Rights Under GDPR

You (and your child, where capable) have the following rights:

• Right of access: to request a copy of all personal data we hold about you
• Right to rectification: to have inaccurate data corrected
• Right to erasure ("right to be forgotten"): to have your data deleted. See Section 11.1 for the anonymisation carve-out where you have consented to anonymised retention, and the Public Tennis Data note for data that remains publicly available outside our control.
• Right to restrict processing: to limit how we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, contact: kieran@signaltennis.com

We will respond to all requests within one calendar month as required by GDPR.

13. Complaints

If you are not satisfied with our response to a data protection request, you have the right to lodge a complaint with the Data Protection Commission (DPC):

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
www.dataprotection.ie
info@dataprotection.ie

14. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.